Merged r12531, r12562, r12563 into 3.12 branch.

test/mjsunit/regress/regress-crbug-150729.js

Index: test/mjsunit/regress/regress-crbug-150729.js
diff --git a/test/mjsunit/regress/regress-119429.js b/test/mjsunit/regress/regress-crbug-150729.js
similarity index 89%
copy from test/mjsunit/regress/regress-119429.js
copy to test/mjsunit/regress/regress-crbug-150729.js
index a87648754a43e8d74b98b642495ba4e40f1551e9..15aa587d184a1fdc67f0c47bae4137beffb266f2 100644
--- a/test/mjsunit/regress/regress-119429.js
+++ b/test/mjsunit/regress/regress-crbug-150729.js
@@ -27,11 +27,13 @@
 
 // Flags: --allow-natives-syntax
 
-var d = 0;
-function recurse() {
-  if (++d == 25135) { // A magic number just below stack overflow  on ia32
-    %DebugBreak();
-  }
-  recurse();
+var t = 0;
+function burn() {
+  i = [t, 1];
+  var M = [i[0], Math.cos(t) + i[7074959]];
+  t += .05;
+}
+for (var j = 0; j < 5; j++) {
+  if (j == 2) %OptimizeFunctionOnNextCall(burn);
+  burn();
 }
-assertThrows(function() { recurse();} );